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REMARKS 

The Examiner has revised the current rejection in light of new prior art and a 
reformulated rejection. As set forth beloWj such new rejection is still deficient 
However, despite such deficiencies and in the spirit of expediting the prosecution of the 
present application, applicant has at least substantially incorporated the subject matter of 
at least one dependent claim into each of the independent claims. Since the subject 
matter of such dependent claim was at least substantially considered by the Examiner, it 
is asserted that such claim amendments would not require new search and/or 
consideration. 

The Examiner has rejected Claims 7-13, 16-24, 27, 34-40, 43-5 1, 54, 61-67, 70- 
78, and 81 under 35 U.S.C. 103(a) as being unpatentable over Hruska et al, (U.S. Patent 
No. 6,195,587), in view of Le Pennec et al. (U.S. Patent No. 6,892,303). Applicant 
respectfully disagrees with such rejection, especially in view of the amendments made 
hereinabove to the independent claims. Specifically, applicant has amended the 
independent claims to include at least a portion of the subject matter of dependent Claim 
13etaL 

With respect to the independent claims, the Examiner has relied on the following 
excerpts from Hruska and Le Pennec to make a prior art showing of applicant's claimed 
technique "wherein said assessment computer stores a database of computer files and said 
database includes for each computer file a persistence flag indicating whether an entry 
relating to said computer file shotild be purged from said database during purge 
operations" (see this or similar, but not necessarily identical language in the independent 
claims). 

^If the file is then authorized by the supervisor/ its checksum 
as calculated by the file server is added to the file server's 
list of checkaumg of authorized tiles (box 27) and a report 
message is returned to the relevant workstation indicating that 
access to the file can be allowed (box 22)." (Hruska, Col. 5, 
lines 14 -IS - emphasis added) 
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''This procedure may be used in addirion to ttie inclueion in files 

o£ data indicating whether the file has been authorized or barred 
from use (not illustrated in FIGS. 3a or 3b). " (Hruska, Col. 3, 
lines 22-25 - emphasis added) 

^It is an object of the present invention to iinprove current 
anti -virus checking methods and to provide a new method using 
file Certificates similar to X.509 Certificates used to 
authenticate an identity. A specific procesa associates a 
Certificate, called virua-free Certificate (VC) ^ with a file in 
order^Q speed up and improve the virus detection ." (Le Pennec, 
Col. 5, lines 29-34 - emphasis added) 



Vlxu>(.AKe l>rttjlnte taUc ^1) 



Receives »(«gw»( for 



tray 




(757) 



Updties fltmiHe VC 



(Le Pennec, Fig. 5, and Fig. 7) 



Applicant respectfully asserts that the excerpts from Hruska relied upon by the 
Examiner merely teach that "[a filers] checksum. . .is added to the file server's list of 
checksums of authorized files" and that "[t]his procedure may be used in addition to the 
inclusion in files of data indicating whether the file has been authorized or barred fix)m 
use," However, Hruska's disclosxire of an authorized file's checksum being stored in a 
file server* s list of checksums in no way suggest a technique whereto said assessment 
computer stores a database_of computer files" (emphasis added), as claimed by applicant. 
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Clearly a list of checksums, where such checksums are of the files, as in Hruska, does not 
meet applicant's claimed database of computer files. 

Furthennore, applicant respectfully asserts that the figures and associated excerpt 
from Le Pennec relied upon by the Examiner simply teach "[a] specific process [that] 
associates a Certificate, called virus-fi^e Certificate (VC), with a file in order to speed up 
and improve the virus detection." Additionally, Le Pennec discloses a "Virus-free 
Certificate Cache Table, [which] is dynamically built by the VCC and comprises a local 
copy of Virus-fi-ee Certificate which have been transmitted through the LANAVAN 
network" and that "[t]he table (501) comprises for each file, one or multiple associated 
Virus-free Certificates '' (Col. 14, line 66-Col. 15, line 4 - emphasis added). 

In addition, Le Pennec discloses that the Vims-free Certificate Section includes 
fields for a "Virus-free Certificate (509) " a "Last_Date (510)," and a ''Number.Hits 
(511)" (Fig. 5), where the "(511) Number_Hits ... is the number of requests (hits) that 
have been received by the VC Cache to retrieve this VC" and that ''[tjypically, this 
number of hits is used when the VC Cache is maintained and when for instance the 
records with the lowest number of hits have to be deleted" (Col. 15, lines 50-54 - 
emphasis added). Further, Le Pennec discloses that '(704) tests whether or not the VC 
Cache Table is full: If the VC Cache Table is fiill: (705) deletes some record of the VC 
Cache Table (706)" and "[tjypically, the records which are deleted are selected according 
to the " Last Date " and " Number_Hits " fields' (Col, 17, lines 58-64 - emphasis added). 

However, the mere disclosure that the Number_Hits are used when the VC Cache 
is maintained and in the instance when the VC Cache Table is full and the oldest records 
have to be deleted or the records with the lowest number of hits have to be deleted in no 
way suggest a technique "wherein said assessment computer stores a database of 
computer files and said database includes for each computer file a persistence flag 
indicating whether an entry relating to said computer file should be purged from said 
database during pwge operations" (emphasis added), as claimed by applicant. Clearly, 
allowing a record to be deleted when the table is full based on the Last_Date and 
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Number Hits fields, especially where such Nuinber_Hits field identifies a aumbey of hits, 
fails to suggest any sort of "persistence flag," in the manner as claimed by applicant. 

To establish a prima facie case of obviousness, three basic criteria must be met. 
First, there must be some suggestion or motivation, either in the references themselves or 
in the knowledge generally available to one of ordinary skill in the art, to modify the 
reference or to combine reference teachings. Second, there mtist be a reasonable 
expectation of success. Finally, the prior art reference (or references when combined) 
must teach or suggest all the claim limitations. The teaching or suggestion to make the 
claimed combination and the reasonable expectation of success must both be found in the 
prior art and not based on applicant's disclosure. In re Vaeck,9^1 F.2d 488, 20 USPQ2d 
1438 CFed.Cinl991). 

Applicant respectfully asserts that at least the third element of the prima facie 
case of obviousness has not been met, since the prior art references, when combined, fail 
to teach or suggest all of the claim limitations, as noted above. Nevertheless, despite 
such paramount deficiencies and in the spirit of expediting the prosecution of the present 
application, applicant has incorporated at least a portion of the subject matter of Claim 13 
et al. into the independent claims. 

With respect to the subject matter of Claim 13 et al. (now incoiporated in part into 
the independent claims), the Examiner has relied on the following excerpts from Hruska, 
as well as Figure 5 from Le Pennec (reproduced above), to make a prior art showing of 
applicant's claimed technique 'Svherein said database includes for each computer file 
fields specifying a filename of said computer file, data identifying said requesting 
computer and a storage location of said computer file, and a checksum value calculated 
from said computer file." 

Again, applicant respectfully asserts that the excerpts from Hruska relied upon by 
the Examiner merely teach that "[a file's] checksum... is added to the file server's list of 
checksums of authorized files" and that "[t]his procedure may be used in addition to the 
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inclusion in files of data indicating whether the file has been authorized or barred firom 
use.'' However, Hruska's disclosure of an authorized fiJe's checksum being stored in a 
file server's list of checksums in no way suggest a technique "wherein said database 
includes for each computer file fields specifying a filename of said computer file, data 
identifying said requesting computer and a storage location of said computer file, and a 
checksum value calculated firom said computer file" (emphasis added), as claimed by 
applicant, 

Furthennore, with respect to the Le Pennec reference, applicant respectfully 
asserts that "FIG. 5 describes the Virus-fi^e Certificate Cache Table according to the 
present invention" (see Col, 6, lines 46^7), and that "[i]n the VC Cache Table , . each 
file is identified by ... the file name, the file type, optionally, the file size, Tandl the file 
CRC" (see Col. 15, lines 5-10 - emphasis added). However, merely disclosing that the 
file is identified by the file name, file type, file size, and file CRC simply, as in Le 
Pennec, fails to even suggest a technique "wheiein said database includes for each 
computer file fields specifying a filename of said computer file, data identifying said 
requesting computer and a storage location of said computer file, and a checksimi value 
calculated from said computer file" (emphasis added), as claimed by applicant. 

Agam, applicant respectfidly asserts that at least the third element of the prima 
facie case of obviousness has not been met, since the prior art references, when 
combined, fail to teach or suggest all of the claim limitations, as noted above. Thus, a 
notice of allowance or specific prior art showing of each of the foregoing claim elements, 
in combination with the remaining claimed features, is respectfully requested. 

To this end, all of the independent claims are deemed allowable. Moreover, the 
remaining dependent claims are further deemed allowable, in view of their dependence 
on such independent claims. 
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In the event a telephone conversation would expedite the prosecution of this 
application, the Examiner may reach the undersigned at (408) 505-5100, The 
Commissioner is authorized to charge any additional fees or credit any overpayment to 
Deposit Account No. 50-1351 (Order No. NAI1P468/01.054.01). 



P.O. Box 721120 

San Jose, CA 95172^1120 

408-505-5100 
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